@cloud-copilot/iam-simulate 0.1.99 → 0.1.101

package/dist/cjs/analysis/analyzeResults.d.ts

@@ -0,0 +1,37 @@
+import { RequestAnalysis } from '../evaluate.js';
+/**
+ * Analyze a RequestAnalysis to see if the request was allowed by identity policies.
+ *
+ * @param requestAnalysis the request analysis
+ * @returns true if the request was allowed by identity policies, false otherwise
+ */
+export declare function isAllowedByIdentityPolicies(requestAnalysis: RequestAnalysis): boolean;
+export type DenialPolicyType = 'identity' | 'resource' | 'scp' | 'rcp' | 'permissionBoundary' | 'endpointPolicy';
+export type RequestDenial = {
+    policyType: DenialPolicyType;
+    identifier?: string;
+    denialType: 'Implicit';
+} | {
+    policyType: DenialPolicyType;
+    policyIdentifier?: string;
+    statementId: string;
+    denialType: 'Explicit';
+};
+/**
+ * Find the policy statements that caused a request to be denied.
+ * Analyzes the RequestAnalysis and returns the specific reasons why the request was denied.
+ *
+ * For an implicit denial, it returns:
+ * - the policy type (identity, resource, scp, rcp, permission boundary, endpoint policy)
+ * - the identifier, if applicable for an Organizational Unit identifier for SCPs.
+ *
+ * For an explicit denial, it returns:
+ * - the policy type (identity, resource, scp, rcp, permission boundary, endpoint policy)
+ * - the policy identifier, if applicable for a managed policy or an SCP
+ * - the statement ID (or index) of the denying statement.
+ *
+ * @param requestAnalysis the request analysis
+ * @returns a list of RequestDenial objects describing the reasons for denial
+ */
+export declare function getDenialReasons(requestAnalysis: RequestAnalysis): RequestDenial[];
+//# sourceMappingURL=analyzeResults.d.ts.map

package/dist/cjs/analysis/analyzeResults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyzeResults.d.ts","sourceRoot":"","sources":["../../../src/analysis/analyzeResults.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,eAAe,EAGhB,MAAM,gBAAgB,CAAA;AAEvB;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,eAAe,EAAE,eAAe,GAAG,OAAO,CAOrF;AAED,MAAM,MAAM,gBAAgB,GACxB,UAAU,GACV,UAAU,GACV,KAAK,GACL,KAAK,GACL,oBAAoB,GACpB,gBAAgB,CAAA;AAEpB,MAAM,MAAM,aAAa,GACrB;IACE,UAAU,EAAE,gBAAgB,CAAA;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,UAAU,CAAA;CACvB,GACD;IACE,UAAU,EAAE,gBAAgB,CAAA;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,UAAU,CAAA;CACvB,CAAA;AAEL;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,eAAe,EAAE,eAAe,GAAG,aAAa,EAAE,CAiBlF"}

package/dist/cjs/analysis/analyzeResults.js

@@ -0,0 +1,95 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isAllowedByIdentityPolicies = isAllowedByIdentityPolicies;
+exports.getDenialReasons = getDenialReasons;
+/**
+ * Analyze a RequestAnalysis to see if the request was allowed by identity policies.
+ *
+ * @param requestAnalysis the request analysis
+ * @returns true if the request was allowed by identity policies, false otherwise
+ */
+function isAllowedByIdentityPolicies(requestAnalysis) {
+    const identityAnalysis = requestAnalysis.identityAnalysis;
+    if (!identityAnalysis) {
+        return false;
+    }
+    return identityAnalysis.result === 'Allowed';
+}
+/**
+ * Find the policy statements that caused a request to be denied.
+ * Analyzes the RequestAnalysis and returns the specific reasons why the request was denied.
+ *
+ * For an implicit denial, it returns:
+ * - the policy type (identity, resource, scp, rcp, permission boundary, endpoint policy)
+ * - the identifier, if applicable for an Organizational Unit identifier for SCPs.
+ *
+ * For an explicit denial, it returns:
+ * - the policy type (identity, resource, scp, rcp, permission boundary, endpoint policy)
+ * - the policy identifier, if applicable for a managed policy or an SCP
+ * - the statement ID (or index) of the denying statement.
+ *
+ * @param requestAnalysis the request analysis
+ * @returns a list of RequestDenial objects describing the reasons for denial
+ */
+function getDenialReasons(requestAnalysis) {
+    const denials = [];
+    const overallResult = requestAnalysis.result;
+    addSimplePolicyDenials(requestAnalysis.identityAnalysis, 'identity', overallResult, denials);
+    addSimplePolicyDenials(requestAnalysis.resourceAnalysis, 'resource', overallResult, denials);
+    addOuPolicyDenials(requestAnalysis.scpAnalysis, 'scp', overallResult, denials);
+    addOuPolicyDenials(requestAnalysis.rcpAnalysis, 'rcp', overallResult, denials);
+    addSimplePolicyDenials(requestAnalysis.permissionBoundaryAnalysis, 'permissionBoundary', overallResult, denials);
+    addSimplePolicyDenials(requestAnalysis.endpointAnalysis, 'endpointPolicy', overallResult, denials);
+    return denials;
+}
+/**
+ * Helper for identity-style policies (identity, resource, permissionBoundary, endpoint).
+ * Adds denial reasons from a simple policy analysis.
+ */
+function addSimplePolicyDenials(analysis, policyType, overallResult, denials) {
+    if (!analysis)
+        return;
+    if (analysis.result === 'ImplicitlyDenied' && overallResult === 'ImplicitlyDenied') {
+        denials.push({ policyType, denialType: 'Implicit' });
+    }
+    else if (analysis.result === 'ExplicitlyDenied' && overallResult === 'ExplicitlyDenied') {
+        for (const stmt of analysis.denyStatements) {
+            denials.push({
+                policyType,
+                policyIdentifier: stmt.policyId,
+                statementId: stmt.statement.sid() || stmt.statement.index().toString(),
+                denialType: 'Explicit'
+            });
+        }
+    }
+}
+/**
+ * Helper for OU-based policies (scp, rcp).
+ * Adds denial reasons from an organizational policy analysis.
+ */
+function addOuPolicyDenials(analysis, policyType, overallResult, denials) {
+    if (!analysis)
+        return;
+    if (analysis.result === 'ImplicitlyDenied' && overallResult === 'ImplicitlyDenied') {
+        for (const ou of analysis.ouAnalysis) {
+            if (ou.result === 'ImplicitlyDenied') {
+                denials.push({ policyType, identifier: ou.orgIdentifier, denialType: 'Implicit' });
+            }
+        }
+    }
+    else if (analysis.result === 'ExplicitlyDenied' && overallResult === 'ExplicitlyDenied') {
+        for (const ou of analysis.ouAnalysis) {
+            if (ou.result === 'ExplicitlyDenied') {
+                for (const stmt of ou.denyStatements) {
+                    denials.push({
+                        policyType,
+                        policyIdentifier: stmt.policyId,
+                        statementId: stmt.statement.sid() || stmt.statement.index().toString(),
+                        denialType: 'Explicit'
+                    });
+                }
+            }
+        }
+    }
+}
+//# sourceMappingURL=analyzeResults.js.map

package/dist/cjs/analysis/analyzeResults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyzeResults.js","sourceRoot":"","sources":["../../../src/analysis/analyzeResults.ts"],"names":[],"mappings":";;AAeA,kEAOC;AAuCD,4CAiBC;AArED;;;;;GAKG;AACH,SAAgB,2BAA2B,CAAC,eAAgC;IAC1E,MAAM,gBAAgB,GAAG,eAAe,CAAC,gBAAgB,CAAA;IACzD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,gBAAgB,CAAC,MAAM,KAAK,SAAS,CAAA;AAC9C,CAAC;AAuBD;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,gBAAgB,CAAC,eAAgC;IAC/D,MAAM,OAAO,GAAoB,EAAE,CAAA;IACnC,MAAM,aAAa,GAAG,eAAe,CAAC,MAAM,CAAA;IAE5C,sBAAsB,CAAC,eAAe,CAAC,gBAAgB,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;IAC5F,sBAAsB,CAAC,eAAe,CAAC,gBAAgB,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;IAC5F,kBAAkB,CAAC,eAAe,CAAC,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;IAC9E,kBAAkB,CAAC,eAAe,CAAC,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;IAC9E,sBAAsB,CACpB,eAAe,CAAC,0BAA0B,EAC1C,oBAAoB,EACpB,aAAa,EACb,OAAO,CACR,CAAA;IACD,sBAAsB,CAAC,eAAe,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;IAElG,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAC7B,QAAyD,EACzD,UAA4B,EAC5B,aAA+B,EAC/B,OAAwB;IAExB,IAAI,CAAC,QAAQ;QAAE,OAAM;IAErB,IAAI,QAAQ,CAAC,MAAM,KAAK,kBAAkB,IAAI,aAAa,KAAK,kBAAkB,EAAE,CAAC;QACnF,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAA;IACtD,CAAC;SAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,kBAAkB,IAAI,aAAa,KAAK,kBAAkB,EAAE,CAAC;QAC1F,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;YAC3C,OAAO,CAAC,IAAI,CAAC;gBACX,UAAU;gBACV,gBAAgB,EAAE,IAAI,CAAC,QAAQ;gBAC/B,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;gBACtE,UAAU,EAAE,UAAU;aACvB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CACzB,QAA+C,EAC/C,UAA4B,EAC5B,aAA+B,EAC/B,OAAwB;IAExB,IAAI,CAAC,QAAQ;QAAE,OAAM;IAErB,IAAI,QAAQ,CAAC,MAAM,KAAK,kBAAkB,IAAI,aAAa,KAAK,kBAAkB,EAAE,CAAC;QACnF,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YACrC,IAAI,EAAE,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;gBACrC,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,CAAC,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAA;YACpF,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,kBAAkB,IAAI,aAAa,KAAK,kBAAkB,EAAE,CAAC;QAC1F,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YACrC,IAAI,EAAE,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;gBACrC,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,cAAc,EAAE,CAAC;oBACrC,OAAO,CAAC,IAAI,CAAC;wBACX,UAAU;wBACV,gBAAgB,EAAE,IAAI,CAAC,QAAQ;wBAC/B,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;wBACtE,UAAU,EAAE,UAAU;qBACvB,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/cjs/index.d.ts

@@ -1,8 +1,9 @@
+export { getDenialReasons, type DenialPolicyType, type RequestDenial } from './analysis/analyzeResults.js';
 export { typeForContextKey } from './context_keys/contextKeys.js';
 export { BaseConditionKeyType, isConditionKeyArray, type ConditionKeyType } from './context_keys/contextKeyTypes.js';
 export { findContextKeys } from './context_keys/findContextKeys.js';
 export type { SimulationMode } from './core_engine/CoreSimulatorEngine.js';
-export type { EvaluationResult, IgnoredCondition, IgnoredConditions } from './evaluate.js';
+export type { EvaluationResult, IgnoredCondition, IgnoredConditions, RequestAnalysis } from './evaluate.js';
 export type { ActionExplain, ConditionExplain, ConditionValueExplain, ExplainPrincipalMatch, PrincipalExplain, ResourceExplain, StatementExplain } from './explain/statementExplain.js';
 export { allowedContextKeysForRequest } from './simulation_engine/contextKeys.js';
 export type { Simulation, SimulationIdentityPolicy, SimulationOrgPolicies } from './simulation_engine/simulation.js';

package/dist/cjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AACjE,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,gBAAgB,EACtB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAA;AACnE,YAAY,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAA;AAC1E,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAC1F,YAAY,EACV,aAAa,EACb,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EACjB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAA;AACjF,YAAY,EACV,UAAU,EACV,wBAAwB,EACxB,qBAAqB,EACtB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAA;AACvE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAA;AACjG,YAAY,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAA;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,+CAA+C,CAAA;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EACnB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AACjE,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,gBAAgB,EACtB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAA;AACnE,YAAY,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAA;AAC1E,YAAY,EACV,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EAChB,MAAM,eAAe,CAAA;AACtB,YAAY,EACV,aAAa,EACb,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EACjB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAA;AACjF,YAAY,EACV,UAAU,EACV,wBAAwB,EACxB,qBAAqB,EACtB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAA;AACvE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAA;AACjG,YAAY,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAA;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,+CAA+C,CAAA;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA"}

package/dist/cjs/index.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isWildcardOnlyAction = exports.runUnsafeSimulation = exports.runSimulation = exports.allowedContextKeysForRequest = exports.findContextKeys = exports.isConditionKeyArray = exports.typeForContextKey = void 0;
+exports.isWildcardOnlyAction = exports.runUnsafeSimulation = exports.runSimulation = exports.allowedContextKeysForRequest = exports.findContextKeys = exports.isConditionKeyArray = exports.typeForContextKey = exports.getDenialReasons = void 0;
+var analyzeResults_js_1 = require("./analysis/analyzeResults.js");
+Object.defineProperty(exports, "getDenialReasons", { enumerable: true, get: function () { return analyzeResults_js_1.getDenialReasons; } });
 var contextKeys_js_1 = require("./context_keys/contextKeys.js");
 Object.defineProperty(exports, "typeForContextKey", { enumerable: true, get: function () { return contextKeys_js_1.typeForContextKey; } });
 var contextKeyTypes_js_1 = require("./context_keys/contextKeyTypes.js");

package/dist/cjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;AAAA,gEAAiE;AAAxD,mHAAA,iBAAiB,OAAA;AAC1B,wEAI0C;AAFxC,yHAAA,mBAAmB,OAAA;AAGrB,wEAAmE;AAA1D,qHAAA,eAAe,OAAA;AAYxB,qEAAiF;AAAxE,8HAAA,4BAA4B,OAAA;AAMrC,+EAAuE;AAA9D,oHAAA,aAAa,OAAA;AAGtB,2FAAmF;AAA1E,gIAAA,mBAAmB,OAAA;AAC5B,qCAAgD;AAAvC,+GAAA,oBAAoB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;AAAA,kEAIqC;AAHnC,qHAAA,gBAAgB,OAAA;AAIlB,gEAAiE;AAAxD,mHAAA,iBAAiB,OAAA;AAC1B,wEAI0C;AAFxC,yHAAA,mBAAmB,OAAA;AAGrB,wEAAmE;AAA1D,qHAAA,eAAe,OAAA;AAiBxB,qEAAiF;AAAxE,8HAAA,4BAA4B,OAAA;AAMrC,+EAAuE;AAA9D,oHAAA,aAAa,OAAA;AAGtB,2FAAmF;AAA1E,gIAAA,mBAAmB,OAAA;AAC5B,qCAAgD;AAAvC,+GAAA,oBAAoB,OAAA"}

package/dist/esm/analysis/analyzeResults.d.ts

@@ -0,0 +1,37 @@
+import { RequestAnalysis } from '../evaluate.js';
+/**
+ * Analyze a RequestAnalysis to see if the request was allowed by identity policies.
+ *
+ * @param requestAnalysis the request analysis
+ * @returns true if the request was allowed by identity policies, false otherwise
+ */
+export declare function isAllowedByIdentityPolicies(requestAnalysis: RequestAnalysis): boolean;
+export type DenialPolicyType = 'identity' | 'resource' | 'scp' | 'rcp' | 'permissionBoundary' | 'endpointPolicy';
+export type RequestDenial = {
+    policyType: DenialPolicyType;
+    identifier?: string;
+    denialType: 'Implicit';
+} | {
+    policyType: DenialPolicyType;
+    policyIdentifier?: string;
+    statementId: string;
+    denialType: 'Explicit';
+};
+/**
+ * Find the policy statements that caused a request to be denied.
+ * Analyzes the RequestAnalysis and returns the specific reasons why the request was denied.
+ *
+ * For an implicit denial, it returns:
+ * - the policy type (identity, resource, scp, rcp, permission boundary, endpoint policy)
+ * - the identifier, if applicable for an Organizational Unit identifier for SCPs.
+ *
+ * For an explicit denial, it returns:
+ * - the policy type (identity, resource, scp, rcp, permission boundary, endpoint policy)
+ * - the policy identifier, if applicable for a managed policy or an SCP
+ * - the statement ID (or index) of the denying statement.
+ *
+ * @param requestAnalysis the request analysis
+ * @returns a list of RequestDenial objects describing the reasons for denial
+ */
+export declare function getDenialReasons(requestAnalysis: RequestAnalysis): RequestDenial[];
+//# sourceMappingURL=analyzeResults.d.ts.map

package/dist/esm/analysis/analyzeResults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyzeResults.d.ts","sourceRoot":"","sources":["../../../src/analysis/analyzeResults.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,eAAe,EAGhB,MAAM,gBAAgB,CAAA;AAEvB;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,eAAe,EAAE,eAAe,GAAG,OAAO,CAOrF;AAED,MAAM,MAAM,gBAAgB,GACxB,UAAU,GACV,UAAU,GACV,KAAK,GACL,KAAK,GACL,oBAAoB,GACpB,gBAAgB,CAAA;AAEpB,MAAM,MAAM,aAAa,GACrB;IACE,UAAU,EAAE,gBAAgB,CAAA;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,UAAU,CAAA;CACvB,GACD;IACE,UAAU,EAAE,gBAAgB,CAAA;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,UAAU,CAAA;CACvB,CAAA;AAEL;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,eAAe,EAAE,eAAe,GAAG,aAAa,EAAE,CAiBlF"}

package/dist/esm/analysis/analyzeResults.js

@@ -0,0 +1,91 @@
+/**
+ * Analyze a RequestAnalysis to see if the request was allowed by identity policies.
+ *
+ * @param requestAnalysis the request analysis
+ * @returns true if the request was allowed by identity policies, false otherwise
+ */
+export function isAllowedByIdentityPolicies(requestAnalysis) {
+    const identityAnalysis = requestAnalysis.identityAnalysis;
+    if (!identityAnalysis) {
+        return false;
+    }
+    return identityAnalysis.result === 'Allowed';
+}
+/**
+ * Find the policy statements that caused a request to be denied.
+ * Analyzes the RequestAnalysis and returns the specific reasons why the request was denied.
+ *
+ * For an implicit denial, it returns:
+ * - the policy type (identity, resource, scp, rcp, permission boundary, endpoint policy)
+ * - the identifier, if applicable for an Organizational Unit identifier for SCPs.
+ *
+ * For an explicit denial, it returns:
+ * - the policy type (identity, resource, scp, rcp, permission boundary, endpoint policy)
+ * - the policy identifier, if applicable for a managed policy or an SCP
+ * - the statement ID (or index) of the denying statement.
+ *
+ * @param requestAnalysis the request analysis
+ * @returns a list of RequestDenial objects describing the reasons for denial
+ */
+export function getDenialReasons(requestAnalysis) {
+    const denials = [];
+    const overallResult = requestAnalysis.result;
+    addSimplePolicyDenials(requestAnalysis.identityAnalysis, 'identity', overallResult, denials);
+    addSimplePolicyDenials(requestAnalysis.resourceAnalysis, 'resource', overallResult, denials);
+    addOuPolicyDenials(requestAnalysis.scpAnalysis, 'scp', overallResult, denials);
+    addOuPolicyDenials(requestAnalysis.rcpAnalysis, 'rcp', overallResult, denials);
+    addSimplePolicyDenials(requestAnalysis.permissionBoundaryAnalysis, 'permissionBoundary', overallResult, denials);
+    addSimplePolicyDenials(requestAnalysis.endpointAnalysis, 'endpointPolicy', overallResult, denials);
+    return denials;
+}
+/**
+ * Helper for identity-style policies (identity, resource, permissionBoundary, endpoint).
+ * Adds denial reasons from a simple policy analysis.
+ */
+function addSimplePolicyDenials(analysis, policyType, overallResult, denials) {
+    if (!analysis)
+        return;
+    if (analysis.result === 'ImplicitlyDenied' && overallResult === 'ImplicitlyDenied') {
+        denials.push({ policyType, denialType: 'Implicit' });
+    }
+    else if (analysis.result === 'ExplicitlyDenied' && overallResult === 'ExplicitlyDenied') {
+        for (const stmt of analysis.denyStatements) {
+            denials.push({
+                policyType,
+                policyIdentifier: stmt.policyId,
+                statementId: stmt.statement.sid() || stmt.statement.index().toString(),
+                denialType: 'Explicit'
+            });
+        }
+    }
+}
+/**
+ * Helper for OU-based policies (scp, rcp).
+ * Adds denial reasons from an organizational policy analysis.
+ */
+function addOuPolicyDenials(analysis, policyType, overallResult, denials) {
+    if (!analysis)
+        return;
+    if (analysis.result === 'ImplicitlyDenied' && overallResult === 'ImplicitlyDenied') {
+        for (const ou of analysis.ouAnalysis) {
+            if (ou.result === 'ImplicitlyDenied') {
+                denials.push({ policyType, identifier: ou.orgIdentifier, denialType: 'Implicit' });
+            }
+        }
+    }
+    else if (analysis.result === 'ExplicitlyDenied' && overallResult === 'ExplicitlyDenied') {
+        for (const ou of analysis.ouAnalysis) {
+            if (ou.result === 'ExplicitlyDenied') {
+                for (const stmt of ou.denyStatements) {
+                    denials.push({
+                        policyType,
+                        policyIdentifier: stmt.policyId,
+                        statementId: stmt.statement.sid() || stmt.statement.index().toString(),
+                        denialType: 'Explicit'
+                    });
+                }
+            }
+        }
+    }
+}
+//# sourceMappingURL=analyzeResults.js.map

package/dist/esm/analysis/analyzeResults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyzeResults.js","sourceRoot":"","sources":["../../../src/analysis/analyzeResults.ts"],"names":[],"mappings":"AASA;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CAAC,eAAgC;IAC1E,MAAM,gBAAgB,GAAG,eAAe,CAAC,gBAAgB,CAAA;IACzD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,gBAAgB,CAAC,MAAM,KAAK,SAAS,CAAA;AAC9C,CAAC;AAuBD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gBAAgB,CAAC,eAAgC;IAC/D,MAAM,OAAO,GAAoB,EAAE,CAAA;IACnC,MAAM,aAAa,GAAG,eAAe,CAAC,MAAM,CAAA;IAE5C,sBAAsB,CAAC,eAAe,CAAC,gBAAgB,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;IAC5F,sBAAsB,CAAC,eAAe,CAAC,gBAAgB,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;IAC5F,kBAAkB,CAAC,eAAe,CAAC,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;IAC9E,kBAAkB,CAAC,eAAe,CAAC,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;IAC9E,sBAAsB,CACpB,eAAe,CAAC,0BAA0B,EAC1C,oBAAoB,EACpB,aAAa,EACb,OAAO,CACR,CAAA;IACD,sBAAsB,CAAC,eAAe,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;IAElG,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAC7B,QAAyD,EACzD,UAA4B,EAC5B,aAA+B,EAC/B,OAAwB;IAExB,IAAI,CAAC,QAAQ;QAAE,OAAM;IAErB,IAAI,QAAQ,CAAC,MAAM,KAAK,kBAAkB,IAAI,aAAa,KAAK,kBAAkB,EAAE,CAAC;QACnF,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAA;IACtD,CAAC;SAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,kBAAkB,IAAI,aAAa,KAAK,kBAAkB,EAAE,CAAC;QAC1F,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;YAC3C,OAAO,CAAC,IAAI,CAAC;gBACX,UAAU;gBACV,gBAAgB,EAAE,IAAI,CAAC,QAAQ;gBAC/B,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;gBACtE,UAAU,EAAE,UAAU;aACvB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CACzB,QAA+C,EAC/C,UAA4B,EAC5B,aAA+B,EAC/B,OAAwB;IAExB,IAAI,CAAC,QAAQ;QAAE,OAAM;IAErB,IAAI,QAAQ,CAAC,MAAM,KAAK,kBAAkB,IAAI,aAAa,KAAK,kBAAkB,EAAE,CAAC;QACnF,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YACrC,IAAI,EAAE,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;gBACrC,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,CAAC,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAA;YACpF,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,kBAAkB,IAAI,aAAa,KAAK,kBAAkB,EAAE,CAAC;QAC1F,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YACrC,IAAI,EAAE,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;gBACrC,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,cAAc,EAAE,CAAC;oBACrC,OAAO,CAAC,IAAI,CAAC;wBACX,UAAU;wBACV,gBAAgB,EAAE,IAAI,CAAC,QAAQ;wBAC/B,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;wBACtE,UAAU,EAAE,UAAU;qBACvB,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/esm/index.d.ts

@@ -1,8 +1,9 @@
+export { getDenialReasons, type DenialPolicyType, type RequestDenial } from './analysis/analyzeResults.js';
 export { typeForContextKey } from './context_keys/contextKeys.js';
 export { BaseConditionKeyType, isConditionKeyArray, type ConditionKeyType } from './context_keys/contextKeyTypes.js';
 export { findContextKeys } from './context_keys/findContextKeys.js';
 export type { SimulationMode } from './core_engine/CoreSimulatorEngine.js';
-export type { EvaluationResult, IgnoredCondition, IgnoredConditions } from './evaluate.js';
+export type { EvaluationResult, IgnoredCondition, IgnoredConditions, RequestAnalysis } from './evaluate.js';
 export type { ActionExplain, ConditionExplain, ConditionValueExplain, ExplainPrincipalMatch, PrincipalExplain, ResourceExplain, StatementExplain } from './explain/statementExplain.js';
 export { allowedContextKeysForRequest } from './simulation_engine/contextKeys.js';
 export type { Simulation, SimulationIdentityPolicy, SimulationOrgPolicies } from './simulation_engine/simulation.js';

package/dist/esm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AACjE,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,gBAAgB,EACtB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAA;AACnE,YAAY,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAA;AAC1E,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAC1F,YAAY,EACV,aAAa,EACb,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EACjB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAA;AACjF,YAAY,EACV,UAAU,EACV,wBAAwB,EACxB,qBAAqB,EACtB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAA;AACvE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAA;AACjG,YAAY,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAA;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,+CAA+C,CAAA;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EACnB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AACjE,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,gBAAgB,EACtB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAA;AACnE,YAAY,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAA;AAC1E,YAAY,EACV,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EAChB,MAAM,eAAe,CAAA;AACtB,YAAY,EACV,aAAa,EACb,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EACjB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAA;AACjF,YAAY,EACV,UAAU,EACV,wBAAwB,EACxB,qBAAqB,EACtB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAA;AACvE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAA;AACjG,YAAY,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAA;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,+CAA+C,CAAA;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA"}

package/dist/esm/index.js

@@ -1,3 +1,4 @@
+export { getDenialReasons } from './analysis/analyzeResults.js';
 export { typeForContextKey } from './context_keys/contextKeys.js';
 export { isConditionKeyArray } from './context_keys/contextKeyTypes.js';
 export { findContextKeys } from './context_keys/findContextKeys.js';

package/dist/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AACjE,OAAO,EAEL,mBAAmB,EAEpB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAA;AAYnE,OAAO,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAA;AAMjF,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAA;AAGvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,+CAA+C,CAAA;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAGjB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AACjE,OAAO,EAEL,mBAAmB,EAEpB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAA;AAiBnE,OAAO,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAA;AAMjF,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAA;AAGvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,+CAA+C,CAAA;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloud-copilot/iam-simulate",
-  "version": "0.1.99",
+  "version": "0.1.101",
   "description": "Simulate evaluation of AWS IAM policies",
   "repository": {
     "type": "git",